The vulnerability resides in the Augmentt web application where the server fails to properly validate user roles before allowing manipulation of request parameters. By altering specific parameters in the URL or form data, a regular authenticated user can trick the system into treating them as a super administrator. This grants them full read/write access to all protected resources and configuration settings, effectively escalating privileges with no additional authentication steps.

The affected product is Augmentt’s web application platform. No specific version numbers are listed in the advisory; therefore, any installation of the Augmentt web application that has not applied a patch from the vendor could be susceptible.

The CVSS score of 9.6 coupled with an unavailable EPSS score indicates a very high severity. The vulnerability allows a standard authenticated user to elevate privileges to super administrator simply by manipulating request parameters, requiring no additional authentication. There are no publicly known exploit scripts, but the attack path is trivial for an attacker controlling a user session. Since the issue is not listed in the CISA KEV catalog, active exploitation in the wild is not yet confirmed, yet the potential impact warrants immediate attention.